CVE-2007-0087

** DISPUTED ** Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/archive/1/455879/100/0/threaded
http://www.securityfocus.com/archive/1/455920/100/0/threaded
http://www.securityfocus.com/archive/1/455882/100/0/threaded
http://osvdb.org/33457
http://www.securityfocus.com/archive/1/455833/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*

Information

Published : 2007-01-05 10:28

Updated : 2018-10-16 09:31

NVD link : CVE-2007-0087

Mitre link : CVE-2007-0087

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

microsoft

internet_information_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/archive/1/455879/100/0/threaded", "name": "20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/455920/100/0/threaded", "name": "20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/455882/100/0/threaded", "name": "20070104 Re: a cheesy Apache / IIS DoS vuln (+a question)", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://osvdb.org/33457", "name": "33457", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/archive/1/455833/100/0/threaded", "name": "20070103 a cheesy Apache / IIS DoS vuln (+a question)", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "** DISPUTED ** Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-0087", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-01-05T18:28Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-16T16:31Z"}